OpenClaw, the npm package referenced as 'openclaw', suffers from a privileged escalation flaw in versions starting at 2026.4.5 and continuing up to but excluding 2026.8.1. The bug arises because session-derived text can be persisted into session memory without properly retaining the originating user’s restriction context or provenance. In configurations where session-memory capture and dreaming are active, an external sender with limited toolset can inject instructions that are later processed by an unattended background dreaming agent that has broader file and command execution rights. The agent will execute those instructions, performing actions beyond the original sender’s authority and affecting files, commands, or services under the agent’s control. The core weakness is a misuse of privileged data from an authenticated session, identified as CWE-863.

Any installation of the OpenClaw npm package between version 2026.4.5 inclusive and 2026.8.1 exclusive is susceptible. The vulnerability impacts the application, not the underlying operating system, and requires an environment where session-memory capture and dreaming features are enabled to be exploitable.

The CVSS score of 7.7 indicates a high severity, and while the EPSS score is currently unavailable, the lack of listing in the CISA KEV catalog suggests no widespread active exploitation is documented. An attacker would need to infect or otherwise influence a session that is stored for dreaming, then cause the system to store crafted instructions in session memory. Although the vulnerability is not publicly exploitable via simple network requests, an application with enabled session functionalities or insider access could exploit it. The risk remains elevated for organizations using OpenClaw within such configurations, especially where background dreaming agents possess elevated privileges.